chore(deps): update workflows (#2552)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/setup-python](https://redirect.github.com/actions/setup-python)
| action | minor | `v5.1.1` -> `v5.2.0` |
|
[actions/upload-artifact](https://redirect.github.com/actions/upload-artifact)
| action | minor | `v3.1.3` -> `v3.2.1` |
|
[github/codeql-action](https://redirect.github.com/github/codeql-action)
| action | minor | `v2.25.12` -> `v2.26.6` |
|
[ossf/scorecard-action](https://redirect.github.com/ossf/scorecard-action)
| action | minor | `v2.3.3` -> `v2.4.0` |
|
[pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish)
| action | minor | `v1.9.0` -> `v1.10.1` |

---

### Release Notes

<details>
<summary>actions/setup-python (actions/setup-python)</summary>

###
[`v5.2.0`](https://redirect.github.com/actions/setup-python/compare/v5.1.1...v5.2.0)

[Compare
Source](https://redirect.github.com/actions/setup-python/compare/v5.1.1...v5.2.0)

</details>

<details>
<summary>actions/upload-artifact (actions/upload-artifact)</summary>

###
[`v3.2.1`](https://redirect.github.com/actions/upload-artifact/releases/tag/v3.2.1)

[Compare
Source](https://redirect.github.com/actions/upload-artifact/compare/v3.2.0...v3.2.1)

#### What's Changed

This fixes the `include-hidden-files` input introduced in
https://github.com/actions/upload-artifact/releases/tag/v3.2.0

- Ensure hidden files input is used by
[@&#8203;joshmgross](https://redirect.github.com/joshmgross) in
[https://github.com/actions/upload-artifact/pull/609](https://redirect.github.com/actions/upload-artifact/pull/609)

**Full Changelog**:
actions/upload-artifact@v3.2.0...v3.2.1

###
[`v3.2.0`](https://redirect.github.com/actions/upload-artifact/releases/tag/v3.2.0)

[Compare
Source](https://redirect.github.com/actions/upload-artifact/compare/v3.1.3...v3.2.0)

#### Notice: Breaking Changes ⚠️

We will no longer include hidden files and folders by default in the
`upload-artifact` action of this version. This reduces the risk that
credentials are accidentally uploaded into artifacts. Customers who need
to continue to upload these files can use a new option,
`include-hidden-files`, to continue to do so.

See ["Notice of upcoming deprecations and breaking changes in GitHub
Actions
runners"](https://github.blog/changelog/2024-08-19-notice-of-upcoming-deprecations-and-breaking-changes-in-github-actions-runners/)
changelog and [this
issue](https://redirect.github.com/actions/upload-artifact/issues/602)
for more details.

#### What's Changed

- V3 backport: Exclude hidden files by default by
[@&#8203;SrRyan](https://redirect.github.com/SrRyan) in
[https://github.com/actions/upload-artifact/pull/604](https://redirect.github.com/actions/upload-artifact/pull/604)

**Full Changelog**:
actions/upload-artifact@v3.1.3...v3.2.0

</details>

<details>
<summary>github/codeql-action (github/codeql-action)</summary>

###
[`v2.26.6`](https://redirect.github.com/github/codeql-action/compare/v2.26.5...v2.26.6)

[Compare
Source](https://redirect.github.com/github/codeql-action/compare/v2.26.5...v2.26.6)

###
[`v2.26.5`](https://redirect.github.com/github/codeql-action/compare/v2.26.4...v2.26.5)

[Compare
Source](https://redirect.github.com/github/codeql-action/compare/v2.26.4...v2.26.5)

###
[`v2.26.4`](https://redirect.github.com/github/codeql-action/compare/v2.26.3...v2.26.4)

[Compare
Source](https://redirect.github.com/github/codeql-action/compare/v2.26.3...v2.26.4)

###
[`v2.26.3`](https://redirect.github.com/github/codeql-action/compare/v2.26.2...v2.26.3)

[Compare
Source](https://redirect.github.com/github/codeql-action/compare/v2.26.2...v2.26.3)

###
[`v2.26.2`](https://redirect.github.com/github/codeql-action/compare/v2.26.1...v2.26.2)

[Compare
Source](https://redirect.github.com/github/codeql-action/compare/v2.26.1...v2.26.2)

###
[`v2.26.1`](https://redirect.github.com/github/codeql-action/compare/v2.26.0...v2.26.1)

[Compare
Source](https://redirect.github.com/github/codeql-action/compare/v2.26.0...v2.26.1)

###
[`v2.26.0`](https://redirect.github.com/github/codeql-action/compare/v2.25.15...v2.26.0)

[Compare
Source](https://redirect.github.com/github/codeql-action/compare/v2.25.15...v2.26.0)

###
[`v2.25.15`](https://redirect.github.com/github/codeql-action/compare/v2.25.14...v2.25.15)

[Compare
Source](https://redirect.github.com/github/codeql-action/compare/v2.25.14...v2.25.15)

###
[`v2.25.14`](https://redirect.github.com/github/codeql-action/compare/v2.25.13...v2.25.14)

[Compare
Source](https://redirect.github.com/github/codeql-action/compare/v2.25.13...v2.25.14)

###
[`v2.25.13`](https://redirect.github.com/github/codeql-action/compare/v2.25.12...v2.25.13)

[Compare
Source](https://redirect.github.com/github/codeql-action/compare/v2.25.12...v2.25.13)

</details>

<details>
<summary>ossf/scorecard-action (ossf/scorecard-action)</summary>

###
[`v2.4.0`](https://redirect.github.com/ossf/scorecard-action/releases/tag/v2.4.0)

[Compare
Source](https://redirect.github.com/ossf/scorecard-action/compare/v2.3.3...v2.4.0)

#### What's Changed

This update bumps the Scorecard version to the v5 release. For a
complete list of changes, please refer to the [v5.0.0 release
notes](https://redirect.github.com/ossf/scorecard/releases/tag/v5.0.0).
Of special note to Scorecard Action is the Maintainer Annotation
feature, which can be used to suppress some Code Scanning false
positives. Alerts will not be generated for any Scorecard Check with an
annotation.

- 🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0
by [@&#8203;spencerschrock](https://redirect.github.com/spencerschrock)
in
[https://github.com/ossf/scorecard-action/pull/1410](https://redirect.github.com/ossf/scorecard-action/pull/1410)
- 🐛 lower license sarif alert threshold to 9 by
[@&#8203;spencerschrock](https://redirect.github.com/spencerschrock) in
[https://github.com/ossf/scorecard-action/pull/1411](https://redirect.github.com/ossf/scorecard-action/pull/1411)

##### Documentation

- docs: dogfooding badge by
[@&#8203;jkowalleck](https://redirect.github.com/jkowalleck) in
[https://github.com/ossf/scorecard-action/pull/1399](https://redirect.github.com/ossf/scorecard-action/pull/1399)

#### New Contributors

- [@&#8203;jkowalleck](https://redirect.github.com/jkowalleck) made
their first contribution in
[https://github.com/ossf/scorecard-action/pull/1399](https://redirect.github.com/ossf/scorecard-action/pull/1399)

**Full Changelog**:
ossf/scorecard-action@v2.3.3...v2.4.0

</details>

<details>
<summary>pypa/gh-action-pypi-publish
(pypa/gh-action-pypi-publish)</summary>

###
[`v1.10.1`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.10.1)

[Compare
Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.10.0...v1.10.1)

#### 🚑🔏 Oopsie... We missed a tiny bug in the attestations feature the
other day

The problem was that the distribution file validity check was failing on
any valid distribution being present and ready to be signed. What a
silly mistake! It's now been fixed via
pypa/gh-action-pypi-publish@0ab0b79, though.
So everything's good!

\--
[@&#8203;webknjaz](https://redirect.github.com/webknjaz)[💰](https://redirect.github.com/sponsors/webknjaz)

> \[!IMPORTANT]
> ✨ Despite this minor hiccup, we invite you to still opt into trying
this feature out early. [It can be
enabled](https://redirect.github.com/marketplace/actions/pypi-publish#generating-and-uploading-attestations)
like this:
>
> ```yml
>   with:
>     attestations: true
> ```
>
> Leave feedback in [the v1.10.0 release
discussion](https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/255)
or [the
PR](https://redirect.github.com/pypa/gh-action-pypi-publish/pull/236).

**🪞 Full Diff**:
pypa/gh-action-pypi-publish@v1.10.0...v1.10.1

**🧔‍♂️ Release Manager:** [@&#8203;webknjaz
🇺🇦](https://redirect.github.com/sponsors/webknjaz)

**🙏 Special Thanks** to
[@&#8203;hugovk](https://redirect.github.com/hugovk)[💰](https://redirect.github.com/sponsors/hugovk)
for [promptly validating the bug
fix](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/256#issuecomment-2325925847),
mere minutes after I pushed it — I even haven't finished writing this
text by then!

###
[`v1.10.0`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.10.0)

[Compare
Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.9.0...v1.10.0)

#### 🔏 Anything fancy, eh?

This time,
[@&#8203;woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw)
implemented support for [PEP 740] attestations functionality in
[#&#8203;236](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/236)
and
[#&#8203;245](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/245).
This is a big deal, as it is a huge step forward to replacing what the
deprecated GPG signatures used to provide in a more meaningful way.

> \[!IMPORTANT]
> ✨ Please, do opt into trying this feature out early. [It can be
enabled](https://redirect.github.com/marketplace/actions/pypi-publish#generating-and-uploading-attestations)
as follows:
>
> ```yml
>   with:
>     attestations: true
> ```
>
> Leave any feedback on this in [this release
discussion](https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/255)
or [the
PR](https://redirect.github.com/pypa/gh-action-pypi-publish/pull/236).

🙏 And please, thank William for working on this amazing improvement for
the ecosystem! The overall effort is tracked
@&#[https://github.com/pypi/warehouse/issues/15871](https://redirect.github.com/pypi/warehouse/issues/15871)/15871,
by the way.

**🪞 Full Diff**:
pypa/gh-action-pypi-publish@v1.9.0...v1.10.0

**🧔‍♂️ Release Manager:** [@&#8203;webknjaz
🇺🇦](https://redirect.github.com/sponsors/webknjaz)

[PEP 740]: https://peps.python.org/pep-0740/

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 6am on wednesday" in timezone
Australia/Sydney, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/google/osv.dev).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC41OS4yIiwidXBkYXRlZEluVmVyIjoiMzguNTkuMiIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Author: renovate-bot

.github/workflows/publish-to-pypi.yaml

@@ -29,7 +29,7 @@ jobs:
         fetch-depth: 0
         submodules: recursive
     - name: Set up Python 3
-      uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
+      uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
       with:
         python-version: 3.7
     - name: Install pypa/build
@@ -44,7 +44,7 @@ jobs:
         build
         --sdist --wheel --outdir dist/ .
     - name: Publish distribution to PyPI
-      uses: pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0 # v1.9.0
+      uses: pypa/gh-action-pypi-publish@0ab0b79471669eb3a4d647e625009c62f9f3b241 # v1.10.1
       with:
         password: ${{ secrets.PYPI_API_TOKEN }}
         packages_dir: dist/

.github/workflows/scorecards.yml

@@ -27,7 +27,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
         with:
           results_file: results.sarif
           results_format: sarif
@@ -42,14 +42,14 @@ jobs:
 
       # Upload the results as artifacts (optional).
       - name: "Upload artifact"
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@e113c555ef0956479345cfc3ed530c938d670db0 # v2.25.12
+        uses: github/codeql-action/upload-sarif@be8b74c09c1778bcdbea38e1a45efea2cb73e18c # v2.26.6
         with:
           sarif_file: results.sarif